If you're using the miniOrange SAML 2.0 Single Sign On plugin for WordPress, you need to update right now. A critical flaw is being actively exploited. Attackers can log in as any user on your site including admins without a password.

Patchstack disclosed the vulnerabilities. These are two different issues. One has a CVSS score of 9.8. The other has a score of 8.1. Both are serious.

If you run a WordPress site with this plugin, your site is at risk. Allow me to explain the situation and how you can be safe.

Quick Summary

What's the Problem?

The miniOrange SAML WordPress vulnerability comes down to bad signature validation.

CVE-2026-15981 - Authentication Bypass

The plug-in uses PHP’s openssl_verify() to verify signatures. The output value will be 1 for success, 0 for failure, and -1 for errors. The plugin treats -1 as success. That's wrong.

An attacker can send a SAML response with a malformed signature. The error is treated as valid. The plugin logs them in as any user they choose.

CVE-2026-61979 - Signature Algorithm Confusion

This one involves algorithm confusion. The attackers can exploit mismatches between signature algorithms for bypassing authentication.

The Result:

No password needed. No credentials required. Full admin access.

How It Was Discovered

DigitalOcean's security team found the miniOrange SAML WordPress vulnerability while investigating something weird. They saw a WordPress admin session attempt from outside their trusted network.

The attacker already had a valid admin session cookie. They couldn't get further because the admin panel was restricted behind the trusted network.

It's Being Exploited Now

Attackers are actively scanning for vulnerable sites.

IP Addresses to Watch:

• 207.211.214.41
• 79.127.224.14
• 102.91.71.83
• 162.243.116.148
• 84.201.6.54
• 64.225.25.188

What Patchstack Said:

"The spread suggests opportunistic scanning rather than a targeted campaign. Whoever is running this appears to be throwing the exploit at every site with the plugin installed without checking which edition or version is behind it."

Proof of Concept Available

A public proof-of-concept is out there. Attackers can use it to take over your site in seconds.

What You Should Do

1. Update Now

Update to version 17.0.6 immediately. Don't wait.

2. Check Your Logs

Look for suspicious admin sessions. Check for login attempts from the IP addresses above.

3. Block the IPs

If you see those IPs in your logs, block them.

4. Monitor Admin Activity

Watch for unusual activity from outside your network.

The Bottom Line

The miniOrange SAML WordPress vulnerability is being actively exploited. Attackers can take over admin accounts without a password.

What You Need to Know:

Action Required:

• Update to Version 17.0.6 now
• Look for indications of compromise
• Block any detected IP addresses
• Watch administrator activity

FAQ Section

What is the miniOrange SAML WordPress vulnerability?

This is  a critical vulnerability since attackers can log in to the system as any user, including admin, by bypassing the SAML signature verification.

What are the CVEs?

CVE-2026-15981 (CVSS 9.8) and CVE-2026-61979 (CVSS 8.1). Both involve authentication bypass.

Which versions are affected?

Versions before 17.0.6. Update to 17.0.6 or later.

Is it being exploited?

Yes. Active scanning and exploitation attempts are happening right now.

What should I do?

Update to version 17.0.6 immediately. Look for signs of compromise. Block any IP addresses seen.

Source: The Hacker News